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Information Commissioner's Office 


ICO call for views on a data protection and 
journalism code of practice 


The Information Commissioner is calling for views on a data 
protection and journalism code of practice (the code). 


The Data Protection Act 2018 requires the Commissioner to produce 
a code of practice that provides practical guidance and promotes 
good practice in regard to processing personal data for the purposes 
of journalism. Our intention is for the code to provide practical, 
pragmatic guidance for journalists on how to comply with data 
protection legislation, building on the detailed guidance that we 
have already produced for this sector. 


This call for views is the first stage of the consultation process. The 
Commissioner is seeking input from relevant stakeholders, including 
media organisations, trade associations, data subjects and those 
representing the interests of data subjects. For further information 
on the call for views, please read our blog post here. 


We will use the responses we receive to inform our work in 
developing the code. 


You can email your response to journalismcode@ico.org.uk. 


Or print and post to: 


Journalism Code Call for Views 
Policy & Engagement Department 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire SK9 5AF 


The call for views will be open until Monday 27th May 2019. 
Privacy statement 


For this consultation we will publish all responses except for those 
where the respondent indicates that they are an individual acting in 
a private capacity (e.g. a member of the public). All responses from 
organisations and individuals responding in a professional capacity 
(e.g. academics, freelance journalists, sole traders, legal 
professionals) will be published. We will remove email addresses 
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and telephone numbers from these responses but apart from this 
we will publish them in full. 


For more information about what we do with personal data please 
see our privacy notice. 


uestions 


Qi Weare considering using our current guidance "Data 


protection and journalism: a guide for the media” as the basis 
on which we will build the new journalism code. Do you agree 


or disagree with this approach? 


L] Agree v 


[_] Disagree 


Q2 If you disagree, please explain why? 


I'd suggest chopping it up into segments that can be updated 
individually, so that relevant information and sections can be 
updated as required, without needing to fully re-issue the whole 
lot, but able to be gathered together for relevant information to 
present and be “read and understood” in bytesized chunks. 


We all rely on journalists to provide us with information, and 
given recent events, it appears they are at the edge of where 
controls for organisations meet individuals, disgruntled persons, 
and potentially good and bad behaviours which may be in other 
persons interests to highlight or discredit. 


As such this makes them at the knife edge of what will become 
standard practice in the future, and why we should take account 
of how the highest standards of information handling can be 
improved, maintained and trained into people for doing this work. 


At the same time, working in a time critical environment, it may 
be the case that mistakes are made, so having appropriate 
mechanisms to withdraw content or demonstrate that it is 
accurate and exactly as when originally made, recorded or written 
is always going to be important, to verify accuracy of content, 
context and address concerns of misrepresentation. 


Journalism Code of Practice - Call for views 
20190429 v1.0 


Q3 "Data protection and journalism: a guide for the media” is 
split into three sections: 


- “Practical guidance” aimed at anyone working in the 
journalism sector; 


- “Technical guidance” aimed at data protection practitioners 
within media organisations; and 


- “Disputes”, aimed at senior editors and staff responsible for 
data protection compliance. 


Do you think we should retain this structure for the code? 


L] ves 
[C] Nov 


Q4 If no, do you have any suggestions about how we should 
structure the code? 


Policy and requirements generally 
What this means for me? 
Practical sections 

Journalist advice 

Organisation advice 

Sources advice 


Appropriate technical and organisational measures (updateable as 
required, individual guidance documents), as with hse guidance. 


Policies, Communication, Sponsorship, Control 


Online content repositories , and age appropriate content marking 
/ radio edit version 


Youtube facebook, online linked to articles on twitter, news pages, 
twitter spats, repositories, source data management 
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Information management systems 

Risk Management 

Points of particular risk 

Notebooks & paper documents 

Physical Controls 

Electonic Controls 

Surveillance, tracking, non-facial recognition requests 


Anpr surveillance against known vehicles 


Access and credentials 

Information release: accidental, deliberate, redaction, deletion 
Location physical specific - People, transport, travel, security, 
safety, country (e.g. middle east/china/usa/uk encryption 
requirements) request for access by authorities & password 
guidance if instructed to login to devices. 


Where to get further advice & how to have a confidential 
discussion 


Case law of relevance 


Section 55 and defences for sources, journalists etc 


Q5 Do you think the ICO’s existing guidance for journalists 
addresses the main areas where data protection issues 
commonly arise? 


L] Agree (mostly) v 


[_] Disagree 
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Q6__siIf no, what additional areas would you like to see covered? 


Like to see more about management of secured information 
where disclosed to third parties, managing control or 
requirements around disclosure. 


If already aware of document, request it formally and get nothing 
in return. 


Fleshing out of disclosure and how it works, perhaps case studies 
of relevant recent high profile cases to examine why/how cases 
turned with updated precidents (as are done with ico decisions on 
the website). 


Q7 The journalism code will address changes in data protection 
law, including developments in relevant case law. Are there 
any particular changes to data protection law that you think 
we should focus on in the code? 


What would be an appropriate amount of time between 
investigation and return of potential evidence, if stored physically 
to prevent return of original content to parties being investigated. 


Where documents have previously been removed will there be a 
requirement to delete data. 


Q8 Apart from recent changes to data protection law, are there 
any other developments that are having an impact on 
journalism that you think we should address in the code? 


Handling of documents provided to journalists as part of 
journalistic activities, which may have been classified by the 
source organisation(s), and how they should be appropriately 
secured in light of gdpr, state secrets legislation, banning orders, 
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confidentiality or non-disclosure agreements, or how such 
settlements may have a default provision for confidentiality etc. 


Ceasure and potential requirement to hand over devices to 
investigating authorities, such as computers or source paperwork 


Disclosure of documents that are from another jurisdiction and 
how laws may apply or have a hierarchy attached 


Source documents or information may be stored or sourced from 
different countries, given how the internet works, and 
company/government information can be held elsewhere - 
protection for documentation in transit between countries in 
physical media against seizure? (e.g. guardian hard disks) 


What about data in transit over vpn or stored in the cloud, 
documentation publishing, redaction and removal from websites, 
or removal of links to content, (or reinstatement where removal 
requests are because of organisation attempting to limit 
embarrassment). 


Workflow software for data handling (media and video files) and 
what it should do and how data albumns or photos can be 
segregated between reasons for storage. 


Q9 Are there any case studies or journalism scenarios that you 
would like to see included in the journalism code? 


Julian Assange - how should people’s belongings or equipment be 
addressed? 


How to remove photos from facebook or retain copyright if they 
are no longer sensible, (i.e. upload incorrect image), or images 
are no longer appropriate at a different phase of life - student life 
vs professional life or divorce occurs/ re-married 


Whilst it’s not journalist specific, the cleansing of profiles i.e. for 
something like maliciously shared pictures and retaining or 
requesting removal of pictures online, such as provided to 
partners that subsequently get shared. 


Journalism Code of Practice - Call for views 
20190429 v1.0 


ico. 


Information Commissioner's Office 


Q10 Do you have any other suggestions for the journalism code? 


Make code modular as there will be instances where advice has to 
be updated, i.e. sdcard handling from video cameras and 
encryption, if available later. 


About you 


1 Are you answering these questions as? 
A media organisation? 
A trade association? 


Q1 
|_| An organisation representing the interests of data subjects? 
|] An academic? 


An individual acting in a professional capacity? v studying 
cybersecurity and how organisations can be more secure. 


An organisation that regulates press standards? 


An individual acting in a private capacity (e.g. someone 
providing their views as a member of the public)? v 


| |] Other? v 


LIU 


If you answered ‘other’ please specify: 


Cybersecurity student and professional with interest in better 
information security 


Q12 How did you find out about this survey? 
| | ICO website 
| | Social media v 
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Conference/seminar 
Trade/professional association 
Media 

Word of mouth 

Other? 


HOCE 


Q13 We may want to contact you about some of the points you 
have raised. If you are happy for us to do this please provide 
your email address: 


Thank you for taking the time to share your views and experience. 
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